[crankshaft] Inline hasOwnProperty when used in fast-case for-in

src/crankshaft/hydrogen.cc

Index: src/crankshaft/hydrogen.cc
diff --git a/src/crankshaft/hydrogen.cc b/src/crankshaft/hydrogen.cc
index 8ff3f3ba3f05afbcade28d2f073afa6c5503fc77..1c28deaeac31b4349dba4fe109994165f1c3d290 100644
--- a/src/crankshaft/hydrogen.cc
+++ b/src/crankshaft/hydrogen.cc
@@ -8752,6 +8752,22 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
   }
   // Try to inline calls like Math.* as operations in the calling function.
   switch (id) {
+    case kObjectHasOwnProperty: {
+      if (argument_count != 2) return false;
+      HValue* key = Top();
+      if (!key->IsLoadKeyed()) return false;
+      HValue* elements = HLoadKeyed::cast(key)->elements();
+      if (!elements->IsPhi() || elements->OperandCount() != 1) return false;
+      if (!elements->OperandAt(0)->IsForInCacheArray()) return false;
+      HForInCacheArray* cache = HForInCacheArray::cast(elements->OperandAt(0));
+      HValue* receiver = environment()->ExpressionStackAt(1);
+      if (!receiver->IsPhi() || receiver->OperandCount() != 1) return false;
+      if (cache->enumerable() != receiver->OperandAt(0)) return false;

[Benedikt Meurer, 2016/03/01 05:00:10]

This subgraph pattern matching in Crankshaft is super scary. It looks OK on the
surface, so let's hope that it will not explode too soonish...

+      Drop(3);  // key, receiver, function
+      Add<HCheckMapValue>(receiver, cache->map());
+      ast_context()->ReturnValue(graph()->GetConstantTrue());
+      return true;
+    }
     case kStringCharCodeAt:
     case kStringCharAt:
       if (argument_count == 2) {